I do not believe that is the case.
The problem started when MTA-STS was added to mailcow.
Before then, Google was advertising via MTA-STS to only use encrypted connections, but they were actually accepting non-encrypted ones.
After the mailcow change, mailcow is checking Google’s MTA-STS settings, which say to never use unencrypted. That is causing my email server to refuse to send email to google unencrypted. (and therefore not at all)
I know it wouldn’t be advised, and I would not plan to use it long-term, but it seems like there should be a way to turn MTA-STS back off, the way it used to be before the recent update.
Comprehensive answer:
Turns out my provider was actually doing SMTP filtering/proxying. See the rest of the thread for how to use openssl to check if you are also affected.
Temporary solution:
Add BOTH of these lines to data/conf/postfix/extra.cf:
smtp_tls_security_level = may
smtp_tls_policy_maps =
This will turn back off MTA-STS (AND DANE) for outbound email.
Long-term, I am looking for a replacement for my provider, as this is very undesirable behavior. (and if you have this same problem, you should too)